Add support for referencing DIDs from the wallet's DID store

[SuperBatata]

This pull request adds support for referencing DIDs (Decentralized Identifiers) stored in the wallet's DID store, in addition to supporting inline DIDs. This enhancement is applied across multiple request and handler classes related to credential issuance, proof signing, and session management. The changes ensure that when both an inline DID and a DID reference are provided, the inline DID takes precedence; otherwise, the referenced DID is used, defaulting to the wallet's default DID if neither is specified.

Support for DID References in Credential Issuance and Proof Handling:

• Added a didReference property to various request data classes (ReceiveCredentialRequest, ReceiveCredentialFromPreviewRequest, SignProofRequest, ReceiveAuthorizedCredentialRequest, WalletIssuanceSessionRequest) to allow referencing a DID from the wallet's DID store. The logic ensures did takes precedence over didReference, and both default to the wallet's default DID if not provided. [1] [2] [3] [4] [5]

• Updated handler logic in WalletIssuanceHandler and WalletIssuanceSessionService to resolve the effective DID using the new didReference property. This affects credential issuance, proof signing, and session creation flows. [1] [2] [3] [4]

API and Internal Consistency Improvements:

• Updated method signatures and internal calls to propagate the new didReference property throughout the credential issuance flow and related operations. [1] [2] [3]

Code Cleanliness and Formatting:

• Minor formatting and consistency improvements, such as trailing commas and parameter alignment, to improve code readability and maintainability. [1] [2] [3] [4] [5] [6] [7] [8]

These changes collectively enhance the flexibility of DID selection in credential issuance and proof processes, making the wallet more adaptable to different use cases and user preferences.

[linear-code]

WAL-1221

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 76ae322b-caea-49ef-81c5-3b4809336831

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This pull request extends the OpenID4VC wallet issuance APIs to support selecting the holder/subject DID via a didReference that is resolved from the wallet’s DID store, in addition to existing inline did usage. The intent is to make DID selection more flexible across issuance session creation and issuance/proof flows while preserving precedence rules (inline did wins).

Changes:

• Added didReference fields to issuance/session request models and threaded that parameter through relevant handler/service flows.
• Updated DID resolution logic to use did first, then resolve didReference from wallet.didStore, then fall back to wallet.defaultDid().
• Minor formatting/serialization-friendly changes (e.g., trailing commas) and small readability adjustments.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceSessionService.kt	Adds didReference to session start requests and resolves the effective DID for new sessions.
waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceHandler.kt	Adds didReference to multiple request DTOs and updates issuance/auth-code/proof-signing flows to resolve DID via DID store when provided.

Suppressed comments (4)

waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceHandler.kt:2100

• In the auth-code flow, an unresolved didReference currently falls back to wallet.defaultDid(). That can cause the continuation to use a different DID than the caller intended. Prefer throwing when didReference is non-null but not resolvable (or when didStore is not configured).

        val holderDid = did
            ?: didReference?.let { wallet.didStore?.getDid(it)?.did }
            ?: wallet.defaultDid()

waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceHandler.kt:371

• SignProofRequest now supports didReference, but (unlike the issuance requests) signProof does not default to the wallet's default DID when neither did nor didReference is provided. If that difference is intentional (e.g., to allow pure JWK binding), it should be documented on the request properties to avoid surprising API consumers.

    val keyId: String? = null,
    val did: String? = null,
    /** Reference to a DID in the wallet's DID store. Ignored when [did] is provided. */
    val didReference: String? = null,

waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceSessionService.kt:332

• New didReference resolution paths (session start, issuance, auth-code flow, proof signing) are not covered by tests. There are already handler/session tests in this module; adding cases for (1) did precedence over didReference, (2) using didReference when did is null, and (3) behavior when the reference cannot be resolved would help prevent regressions.

            did = request.did
                ?: request.didReference?.let { wallet.didStore?.getDid(it)?.did }
                ?: wallet.defaultDid(),

waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceHandler.kt:1172

• In signProof, an unresolved didReference is silently ignored, which can unexpectedly switch the proof binding from DID-based (kid) to JWK-based (jwk). If a caller supplies didReference, it would be safer to fail fast when it cannot be resolved from the wallet DID store.

        val resolvedDid = request.did
            ?: request.didReference?.let { wallet.didStore?.getDid(it)?.did }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud